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I. REAL PARTY IN INTEREST 

The real party in interest is the assignee of the present application, Yamatake Corporation 
of Tokyo, Japan. 

II. RELATED APPEALS AND INTERFERENCES 

There are no prior or pending appeals, interferences, or judicial proceedings known to 
Appellant, Appellant's legal representative, or the assignee that may be related to, directly affect 
or be directly affected by, or have a bearing on the Board's decision in the pending appeal. 

III. STATUS OF CLAIMS 

Claims 1-27 have been presented for examination. Claims 1-27 stand finally rejected and 
forms the subject matter of the present appeal. 

IV. STATUS OF AMENDMENTS 

No claim amendments were submitted after the mailing of the Final Rejection dated 
November 26, 2008. 

V. SUMMARY OF CLAIMED SUBJECT MATTER 

The present invention relates to a network monitoring system that monitors 
communication between a client and server and displays the type of operating system employed 
by the client, the type of operating system employed by the server, an account name of a user 
accessing the client, and an icon representing the account name. In an exemplary, but non- 
limiting, embodiment of the claimed subject matter illustrated by Applicants' Fig. 7, the 
operating system of a client (e.g., 2000 PRO), the operating system of a server (e.g., 2000 SVR). 
an account name of a user accessing the client (e.g., Kawasaki), and an icon representing the 
account name are displayed with information of an operational action involving the client and 
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server (see specification page 20, line 7, through page 21, line 10). Thus, the invention provides 
a highly intuitive identification of a client and server and the operation in which they are engaged 
and an icon representing a particular user's interaction with the client and server. 

The references herein to the specification and drawings are for illustrative purposes only 
and are not intended to limit the scope of the invention to the referenced embodiments. 

VI. GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 

Whether claims 1-27 stand properly rejected, under 35 USC § 103(a), as being 
unpatentable over the individual or combined teachings of Cartsonis (US Pat. No. 6.584,501) in 
view of Ludwig (US Pat. No 6,351,762).' 

VII. ARGUMENT 

A. Applicable Law 

To establish a prima facie case of obviousness, all claim limitations must be taught or 
suggested by the prior art. MPEP §2143.03, first sentence; In re Royka, 490 F.2d 981, 984-985, 
180 USPQ 580, 583 (CCPA 1974). Rejections on obviousness cannot be sustained by mere 
conclusory statements. Instead, there must be some articulated reasoning with some rational 
underpinning to support the legal conclusion of obviousness. See KSR International v. Tele/lex 
Inc., U.S. Supreme Court No. 04-1350 ( 2007) In re Kahn, 441 F.3d 977, 986, 78 USPQ2d 1329, 
1335 (Fed. Cir. 2006) and see MPEP §2143.01(1), first sentence of third paragraph. 

As stated in KSR, exemplary rationales that may support a conclusion of obviousness 
include: 



1 We note that the rejection under 35 USC 102(b) is improper, and proceed with the understanding that the 
Examiner intended to reject the claims under 35 USC 103(a), given the use of multiple references. 
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(A) Combining prior art elements according to known methods to yield predictable 

results; 

(B) Simple substitution of one known element for another to obtain predictable results; 

(C) Use of known technique to improve similar devices (methods, or products) in the 
same way; 

(D) Applying a known technique to a known device (method, or product) ready for 
improvement to yield predictable results; 

(E) "Obvious to try" - choosing from a finite number of identified, predictable solutions, 
with a reasonable expectation of success; 

(F) Known work in one field of endeavor may prompt variations of it for use in either the 
same field or a different one based on design incentives or other market forces if the variations 
are predictable to one of ordinary skill in the art; 

(G) Some teaching, suggestion, or motivation in the prior art that would have led one of 
ordinary skill to modify the prior art reference or to combine prior art reference teachings to 
arrive at the claimed invention. See MPEP § 2143. 
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B. Rejection of Claims 1-27 Under 35 USC § 103(a), as Being Unpatentable Over the 
Individual or Combined Teachings of Cartsonis (US Pat. No. 6,584,501) in view of Ludwig (US 
Pat. No 6,351,762). 

1. Response to Advisory Action Re marks 

a. Response to Remarks that Applicant has Failed to Poin t Out Any Flaws in Examiner's 
Official Notice 

The Examiner, in paragraph (A) on page 2 of the Advisory Action, alleges that Appellants 
have failed to point out any flaws in the Examiner's taking Official Notice. Specifically, the 
Examiner notes that "an Applicant must specifically point out the supposed errors in the 
Examiner's Action. . ..[but] that Applicant instead merely alleges that 'it is improper to take 
Official Notice of this technical fact without citing any references. . Appellants respectfully 
disagree with the Examiner's assertion. 

The Examiner's Official Notice, on page 4 of the final Office Action, simply states that 
"Official Notice (see MPEP 2144.03) is taken, that it is well known in the art at the time the 
invention was made to display the above recited limitations" (referring to the limitation "wherein 
the information displayed by the display unit includes the type of operating system employed by 
the client, the type of operating system employed by the server, an account name of a user 
accessing the client and an icon representing the account name."). As set forth in detail in the 
arguments below, Appellants have made it abundantly clear that the Examiner's Official Notice is 
improper and should be withdrawn . Appellants have also stated why the "noticed fact" is not 
considered to be common knowledge or well-known in the art. Indeed, Appellants specifically 
state "it is improper to take Official Notice of this technical fact [, referring to the four different 
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types of data,] without citing to any references because MPEP 2144.03 states that 'assertions of 
technical facts . . .must always be supported by citation to some reference work recognized as 
standard in the pertinent art.' Therefore, it is respectfully submitted that the Office Action's 
Official Notice is improper, and the rejection of claim 1 should be withdrawn for at least this 
reason." (Emphasis added). It is respectfully submitted that Appellant's statement, and 
corresponding reasoning regarding the four different types of data, that the Examiner's rejection 
is improper and should be withdrawn is sufficient to traverse the rejection. 

Additionally, the Examiner first takes Official Notice in the final Office Action. The 
MPEP at 2144.03 specifically states that "Official notice without documentary evidence to 
support an examiner's conclusion is permissible only in some circumstances. While 'official 
notice' may be relied on, these circumstances should be rare when an application is under final 
rejection or action under 37 CFR 1.113." (Emphasis added). In this case, the Examiner is first 
introducing Official Notice during the final Office Action. The Examiner had every opportunity 
in the final Office Action and the Advisory Action to provide evidentiary documentation in 
support of this Official Notice, but failed to do so. 

Since the rejection has been properly traversed, and the Examiner has failed to provide 
evidentiary documentation in support of his Official Notice, Appellants respectfully submit that 
the rejection to claims 1-27 should be withdrawn. 

b. Response to Remarks that Ludwig Clearly Discloses Continuous Play-back 

The Examiner, in paragraph (B) on page 2 of the Advisory Action, states that "Applicant 
has not provided any limiting features which define what the continuous play back is, therefore 
any playback that is uninterrupted fulfills this functionality." Appellants respectfully disagree. 
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The claims clearly recite that the continuous play back is of information of a sequence of 
individual actions that occurred on the network (See, for example, individual actions depicted in 
Fig. 9). That is, the di spl ay- in form ation generation section regenerates information of a sequence 
of individual actions that occurred on the network for continuous play back, as required by 
claims 1, 9 and 17. 

Additionally, the Examiner submits that "nowhere does the claim recite 'continuous play 
back' that actually occurs, rather the language ('for continuous play back') has questionable 
patentable weight." Here, the Examiner argues that the "for continuous play back" language does 
not reflect the regenerating directly, but rather what the regeneration "is for" or its intended use. 
Appellants respectfully disagree. 

The claims recite, for example, that a display-information generation section regenerates 
information. This regenerated information is specifically regenerated for continuous play back, 
The display-information generation section therefore must have sufficient structure or means to 
allow regeneration for continuous play back. The display-information generation section 
therefore must be able to regenerate the analysis data stored in the analysis data storage section, 
as described, for example on page 22 of the instant specification. When a play back function is 
selected from a menu and a display item is set, a screen is displayed. As described, when the 
display-information generation section 34 recognizes that a button displayed on the screen is 
clicked and selected by a user, the display-information generation section performs processing in 
response the clicked and selected button (page 22, lines 5-23). An action may also be played 
back and displayed continuously at the approximately same time intervals in response to a 
request of a user (page 23, lines 1-5). Clearly this process amounts to more than simply an 
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intended use of the display-information generation section, and therefore must be granted 
patentable weight. 

2. Response to Final Rejection R emarks 

a. The Examiner has Failed to Provide Proper Support for the Official Notice 

The Examiner concedes in the Final Office Action that neither Cartsonis nor Ludwig 

teach or suggest the feature of: "the information displayed by the display unit includes the type of 

operating system employed by the client, the type of operating system employed by the server, an 

account name of a user accessing the client, and an icon representing the account name," as 

recited, for example, by claims 1, 9 and 17. However, the Examiner takes Official Notice that it 

was well known at the time of the invention to display the above recited limitations, without 

providing any evidentiary support thereof. 

According to MPEP 2144.03: 

"Official notice without documentary evidence to support an examiner's 
conclusion is permissible only in some circumstances. While 'official notice' may 
be relied on, these circumstances should be rare when an application is under final 
rejection or action under 37 CFR 1.113. Official notice unsupported by 
documentary evidence should only be taken by the examiner where the facts 
asserted to be well known, or to be common knowledge in the art, are capable of 
instant and unquestionable demonstration as being well-known." 

For example, it would be appropriate for an Examiner to take Official Notice that "it is 

old to adjust intensity of a flame in accordance with the heat requirement." MPEP 2144.03. In 

contrast, it is ".. .not appropriate for the examiner to take official notice of facts without citing a 

prior art reference where the facts asserted to be well known are not capable of instant and 

unquestionable demonstration as being well known." Id For example, "assertions of technical 
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facts in the areas of esoteric technology or specific knowledge of the prior art must always be 
supported by citation to some reference work recognized as standard in the pertinent art." Id. 

Here, the Examiner takes Official Notice that it was well known at the time of the 
invention to display four different types of data , including "the type of operating system 
employed by the client, the type of operating system employed by the server, an account name of 
a user accessing the client, and an icon representing the account name," using a display unit of a 
network monitoring system that monitors communication between a client and server. This 
recited feature of the claimed invention is a technical feature, unlike the limitation of "adjusting a 
flame in accordance with the heat requirement." Therefore, the Examiner is taking Official 
Notice with respect to a technical fact. However, the Examiner fails to cite any references in 
support of the argument that it was well known at the time of the invention for network 
monitoring systems to display all four of these types of data . As a result, it is improper to take 
Official Notice of this technical fact without citing to any references because MPEP 2144.03 
states that "assertions of technical facts in the areas of esoteric technology or specific knowledge 
of the prior art must always be supported by citation to some reference work recognized as 
standard in the pertinent art." (Emphasis added). Therefore, it is respectfully submitted that the 
Examiner's Official Notice is improper, and the rejection of claims 1-27 should be withdrawn for 
at least this reason. 

b. The Prior Art Reference to Ludwig Does Not Disclose Continuous Play-back 
It is respectfully submitted that Ludwig does not teach or suggest the claimed feature of 
"in response to a request by a user, the display-information generation section regenerates, for 
continuous play back, information of a sequence of individual actions that occurred on the 
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network and cooperates with the display unit to display, during each play back, the regenerated 

in formation of each individual action of the sequence at the same time interval within the 

sequence as the action occurred," as recited by the claimed invention (see, for example, claims 1 , 

9 and 17). In the final Office Action at page 4, the Examiner argues that Ludwig teaches this 

claimed feature at col. 28, lines 48-65. However, col. 28, lines 48-65 state the following: 

"Examples of time-sensitive media that can be stored on conventional file systems 
are small audio files and short or low-quality video clips (e.g., as might be 
produced using QuickTime or Video for Windows). Other examples include 
window event lists as supported by the Window-Event Record and Play system 
512 shown in FIG. 30. This component allows for storing and replaying a user's 
interactions with application programs by capturing the requests and events 
exchanged between the client program and the window system in a time-stamped 
sequence. After this "record" phase, the resulting information is stored in a 
conventional file that can later be retrieved and "played" back. During playback 
the same sequence of window system requests and events reoccurs with the same 
relative timing as when they were recorded. In prior-art systems, this capability 
has been used for creating automated demonstrations. In the present invention it 
can be used, for example, to reproduce annotated snapshots as they occurred at 
recording (emphasis added)." 

Reproducing annotated snapshots is not the same as continuously playing back 

information of a sequence of individual actions, as recited by claims 1 , 9 and 17. Instead, 

reproducing annotated snapshots is a discretely-reproducing process, i.e., a process for 

reproducing by thinning out intermediate images, that does not involve the continuous playback 

of any information. For example, displaying a PowerPoint presentation of 30 annotated screen 

shots extracted from a 2 -hour movie is not the same as continuously playing back the 2-hour 

movie itself. Nothing in Ludwig teaches or suggest anything about continuous reproduction of 

data, and in fact, Ludwig discloses using "Snapshot Share 514" (FIG. 30) for "capturing window 

or screen snapshots." Col. 28, line 67- col. 9, line 6. Capturing window or screen snapshots, like 
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reproducing annotated snapshots, does not teach or suggest the operation of continuously playing 
back information of a sequence of individual actions as recited by claims 1 , 9 and 17. "All words 
in a claim must be considered in judging the patentability of that claim against the prior art." 
MPEP 2143.03. Since Ludwig fails to teach or suggest this recited feature of the claimed 
invention, and since none of the other references cure this deficiency of Ludwig, it is respectfully 
submitted that the rejection of claims 1 , 9 and 1 7 should be withdrawn for at least this reason as 
well. 

Claims 2-8 and 25 depend on claim 1 . Accordingly, it is respectfully submitted that the 
rejections of claims 2-8 and 25 should be withdrawn for at least the same reasons that the 
rejection of claim 1 should be withdrawn. Claims 10-16 and 26 depend on claim 9. 
Accordingly, it is respectfully submitted that the rejection of claims 10-16 and 26 should be 
withdrawn for at least the same reasons that the rejection of claim 9 should be withdrawn. 
Claims 18-24 and 27 depend on claim 17. Accordingly, it is respectfully submitted that the 
rejection of claims 18-24 and 27 should be withdrawn for at least the same reasons that the 
rejection of claim 17 should be withdrawn. 
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C. Conclusion 



In view of the law and facts stated herein, it is respectfully submitted that the rejected 
claim defines patentable subject matter. Therefore, reversal of the outstanding ground of 
rejection is respectfully solicited. 

Respectfully submitted, 

/James Edward Ledbetter/ 

Date: June 16. 2009 James E. Ledbetter 

Registration No. 28,732 

JEL/DWW/att 

Attorney Docket No. 009289-04146 
Dickinson Wright PLLC 
1875 Eye Street, NW, Suite 1200 
Washington, DC 20006 
Telephone: (202) 659-6960 
Facsimile: (202) 659-1559 
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VIII. CLAIM APPENDIX 



1 . A network monitoring system that monitors communication between a client and 
server, the network monitoring system comprising: 

a data acquisition section that acquires a plurality of packets flown on a network; 

a data analysis section that acquires action explanation information from the plurality of 
packets acquired by the data acquisition section; 

a display-information generation section that generates information of each individual 
action occurring on the network on the basis of the action explanation information acquired by 
the data analysis section; and 

a display unit that displays the information generated by the display-information 
generation section, wherein: 

in response to a request by a user, the display-information generation section regenerates, 
for continuous play back, information of a sequence of individual actions that occurred on the 
network and cooperates with the display unit to display, during each play back, the regenerated 
information of each individual action of the sequence at the same time interval within the 
sequence as the action occurred, 

action explanation information for explaining each individual action is acquired from a 
plurality of packets, and 

the information displayed by the display unit includes the type of operating system 
employed by the client, the type of operating system employed by the server, an account name of 
a user accessing the client, and an icon representing the account name. 
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2. The network monitoring system according to claim 1 , wherein the action explanation 
information is defined in advance. 

3. The network monitoring system according to claim 1, wherein the data analysis 
section identifies kinds of the packets acquired by the data acquisition section and acquires the 
action explanation information from the packets on the basis of the identified kinds of the 
packets. 

4. The network monitoring system according to claim 1, wherein the action explanation 
information includes: 

sending source computer information and destination computer inforcnation included in a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet; and 

data included in a data packet. 

5. The network monitoring system according to claim 1, further comprising: 

an analysis data storage section that stores the action explanation information acquired by 
the data analysis section, wherein: 
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the display-information generation section regenerates the information of the sequence of 
individual actions that occurred on the network from the action explanation information stored 
by the analysis data storage section. 

6. The network monitoring system according to claim 5, wherein; 

the action explanation information stored by the analysis data storage section includes 
time information, which corresponds to the time at which the single action occurred; and 

the display-information generation section determines the time interval, within the 
sequence, that each individual action occurred using the time information stored by the analysis 
data storage section. 

7. The network monitoring system according to claim 5, wherein the display-information 
generation section continuously regenerates the sequence after each predetermined period, which 
period is accurate within 500 milliseconds. 

8. The network monitoring system according to claim 1, wherein the display-information 
generation section extracts and generates the information of each action occurring on the network 
in accordance with a display setting set by a user. 

9. A network monitoring method for monitoring communication between a client and 
server, the method comprising: 

acquiring a plurality of packets flown on a network; 
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acquiring action explanation information from the plurality of acquired packets; 

generating information of each individual action occurring on the network on the basis of 
the acquired action explanation information; 

regenerating for continuous play back, in response to a request by a user, information of a 
sequence of individual actions that occurred on the network; and 

displaying on a display unit, during each play back, the regenerated information of each 
individual action of the sequence at the same time interval within the sequence as the action 
occurred, wherein: 

action explanation information for explaining each individual action is acquired from a 
plurality of packets, and 

the information displayed on the display unit includes the type of operating system 
employed by the client, the type of operating system employed by the server, an account name of 
a user accessing the client, and an icon representing the account name. 

10. The network monitoring method according to claim 9, wherein the action explanation 
information is defined in advance. 

1 1 . The network monitoring method according to claim 9, wherein in the acquisition of 
the action explanation information, kinds of the packets acquired by the packet acquisition are 
identified and the action explanation information is acquired from the packets on the basis of the 
identified kinds of the packets. 
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12. The network monitoring method according to claim 9, wherein the action explanation 
information includes: 

sending source computer information and destination computer information included in a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet; and 

data included in a data packet. 

13. The network monitoring method according to claim 9, further comprising: 
storing the acquired action explanation information, wherein: 

the information of the sequence of individual actions that occurred on the network is 
regenerated from the stored action explanation information. 

14. The network monitoring method according to claim 13, wherein: 

the stored action explanation information includes time information, which corresponds 
to the time at which the single action occurred; and 

the time interval, within the sequence, that each individual action occurred is determined 
using the stored time information. 
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15. The network monitoring method according to claim 13, further comprising 
continuously regenerating the sequence after each predetermined period, which period is accurate 
within 500 milliseconds. 

16. The network monitoring method according to claim 9, wherein the information of 
each action occurring on the network is extracted and generated in accordance with a display 
setting set by a user. 

17. A network monitoring program recorded on a computer readable medium and 
executable by a computer, the program making the computer monitor communication between a 
client and server and perform a process comprising: 

acquiring a plurality of packets flown on a network; 

acquiring action explanation information from the plurality of acquired packets; 

generating information of each individual action occurring on the network on the basis of 
the acquired action explanation information; 

regenerating for continuous play back, in response to a request by a user, information of a 
sequence of individual actions that occurred on the network; and 

displaying on a display unit, during each play back, the regenerated information of each 
individual action of the sequence at the same time interval within the sequence as the action 
occurred, wherein 

action explanation information for explaining each individual action is acquired from a 
plurality of packets, and 
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the information displayed on the display unit includes the type of operating system 
employed by the client, the type of operating system employed by the server, an account name of 
a user accessing the client, and an icon representing the account name. 

1 8. The network monitoring program according to claim 17, wherein the action 
explanation information is defined in advance. 

19. The network monitoring program according to claim 17, wherein in the acquisition of 
the action explanation information, kinds of the packets acquired by the packet acquisition are 
identified and the action explanation information is acquired from the packets on the basis of the 
identified kinds of the packets. 

20. The network monitoring program according to claim 1 7, wherein the action 
explanation information includes: 

sending source computer information and destination computer information included in a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet; and 

data included in a data packet. 

21 . The network monitoring program according to claim 1 7, wherein: 
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the process further comprises storing the acquired action explanation information; and 
the information of the sequence of individual actions that occurred on the network is 
regenerated from the stored action explanation information. 

22. The network monitoring program according to claim 21, wherein: 

the stored action explanation information includes time information, which corresponds 
to the time at which the single action occurred; and 

the time interval, within the sequence, that each individual action occurred is determined 
using the stored time information. 

23. The network monitoring program according to claim 21 , wherein the process further 
comprises continuously regenerating the sequence after each predetermined period, which period 
is accurate within 500 milliseconds. 

24. The network monitoring program according to claim 1 7, wherein the information of 
each action occurring on the network is extracted and generated in accordance with a display 
setting set by a user. 

25. The network monitoring system of claim 1, wherein the display unit displays a 
graphical representation of the communication connection between the client and the server. 
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26. The network monitoring method of claim 9, wherein the display unit displays a 
graphical representation of the communication connection between the client and the server. 

27. The network monitoring program of claim 17, wherein the display unit displays a 
graphical representation of the communication connection between the client and the server. 
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IX. EVIDENCE APPENDIX 

There is no evidence submitted pursuant to 37 CFR §§1.130, 1.131, or 1.132 of this title 
or any other evidence entered by the examiner and relied upon by Appellant in the appeal. 
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X. RELATED PROCEEDINGS APPENDIX 

There are no decisions rendered by a court or the Board in any proceeding identified 
pursuant to 37 CFR §41 .37(c)(l)(ii). 
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